CVE-2021-30141

Vulnerability

In Friendica versions through 2021.01, the Module/Settings/UserExport.php endpoint is accessible without authentication, contrary to its intended restriction to logged-in users [1][2]. The route settings/userexport does not check for a valid user session before attempting to process an export request, causing a PHP notice when trying to access an array offset on a null value (Trying to access array offset on value of type null in UserExport.php on line 93) and subsequently triggering a fatal error when the system exhausts the allowed memory (e.g., Allowed memory size of 218103808 bytes exhausted in Database.php) [2].

Exploitation

An anonymous attacker can simply navigate to the settings/userexport URL in a browser or via an HTTP request without any authentication cookie. No user interaction or special network position is required beyond basic HTTP access to the Friendica instance [2]. The server will attempt to handle the request, resulting in the memory exhaustion condition.

Impact

Successful exploitation leads to a denial of service (DoS) due to memory exhaustion, rendering the Friendica instance unresponsive or crashing the PHP process. While the vendor notes that the feature still requires a valid authentication cookie for actual data export, the unauthenticated route itself triggers fatal memory allocation errors, impacting availability [1][2]. No data disclosure or privilege escalation is achieved.

Mitigation

The vulnerability was fixed in commit acbcc56754121ba080eac5b6fdf69e64ed7fe453 which adds a check for local_user() at the beginning of the content() method and throws an HTTPException if the user is not authenticated, thus preventing anonymous access [1]. The fix was included in Friendica version 2021.04 and later. Users should update to at least that version. No workaround is provided for unpatched versions.